What is the primary purpose of using a sandboxed container runtime like Kata Containers?

To simplify container image management

To provide stronger isolation for untrusted workloads

How is a RuntimeClass assigned to a pod?

By setting an environment variable in the container

By setting the runtimeClassName field in the pod spec

Your company runs a multi-tenant cluster where some workloads are considered untrusted (e.g., code submitted by external users). You need to provide stronger isolation for these workloads to protect the host kernel from potential exploits. Which approach should you use?

Apply the Restricted Pod Security Standard to the untrusted workloads.

Use a NetworkPolicy to block all egress traffic from the untrusted workloads.

Run the untrusted workloads in a separate namespace with a ResourceQuota.

Create a RuntimeClass that uses the gVisor (runsc) runtime and configure the untrusted workloads to use this RuntimeClass.

Certified Kubernetes Security Specialist (CKS)

Domain 1Objective 4

Workload and Data Security CKS Practice Questions (Page 3)

Part of the Cluster Setup domain, which accounts for 15% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

11concepts

15%of the exam

Questions 11–15

11foundation · easy
Which Pod Security Standard is the least restrictive and is intended for system-level workloads that require broad privileges?
Select an answer first
12foundation · easy
Which Kubernetes resource is used to control network traffic between pods?
Select an answer first
13foundation · easy
What is the primary purpose of using a sandboxed container runtime like Kata Containers?
Select an answer first
14foundation · easy
How is a RuntimeClass assigned to a pod?
Select an answer first
15application · medium
Your company runs a multi-tenant cluster where some workloads are considered untrusted (e.g., code submitted by external users). You need to provide stronger isolation for these workloads to protect the host kernel from potential exploits. Which approach should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Workload and Data Security CKS Practice Questions (Page 3)

Questions 11–15

Which Pod Security Standard is the least restrictive and is intended for system-level workloads that require broad privileges?

Which Kubernetes resource is used to control network traffic between pods?

What is the primary purpose of using a sandboxed container runtime like Kata Containers?

How is a RuntimeClass assigned to a pod?

Your company runs a multi-tenant cluster where some workloads are considered untrusted (e.g., code submitted by external users). You need to provide stronger isolation for these workloads to protect the host kernel from potential exploits. Which approach should you use?

Keep studying — Cluster Setup